[stable/grafana] Unable to set Grafana Env Var

[andrew-pickin-epi]

Attempting to create an entry fro a Grafana environment variable causes an error:

    grafana:
      enabled: true
      env:
        - name: GF_FOO
          value: bar

Results in:

ts=2020-06-22T17:28:02.984996473Z caller=release.go:292 component=release release=prometheus-operator targetNamespace=monitoring resource=monitoring:helmrelease/prometheus-operator helmVersion=v3 error="upgrade failed: template: prometheus-operator/charts/grafana/templates/secret.yaml:1:58: executing \"prometheus-operator/charts/grafana/templates/secret.yaml\" at <.Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE>: can't evaluate field GF_SECURITY_ADMIN_PASSWORD__FILE in type interface {}" action=upgrade

The same is true fro setting by SecretKeyRef, including setting the GF_SECURITY_ADMIN_PASSWORD__FILE variable itself.

[tahsinrahman]

i'm also facing the same issue

$ helm upgrade --install -n monitoring prometheus-operator stable/prometheus-operator --version 8.15.6 --set grafana.env[0].name=KEY --set grafana.env[0].value=VALUE 
coalesce.go:196: warning: cannot overwrite table with non table for env (map[])
Error: UPGRADE FAILED: template: prometheus-operator/charts/grafana/templates/secret.yaml:1:58: executing "prometheus-operator/charts/grafana/templates/secret.yaml" at <.Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE>: can't evaluate field GF_SECURITY_ADMIN_PASSWORD__FILE in type interface {}

[aramhakobyan]

+1

[tahsinrahman]

i found the solution, actually env expects an object, not an array, so you need to do --set grafana.env.key1=value1 --set grafana.env.key2=value2 or,

grafana:
  enabled: true
  env:
    key1: value1
    key2: value2

[gldraphael]

FWIW this also happens in the stable/grafana chart. Here's my values:

grafana.ini:
  database:
    type: mysql
    name: grafana
    ssl_mode: skip-verify
    host: mysql-host-goes-here
    user: mysql-user-goes-here
    password: ${GF_DATABASE_PASSWORD} # This *shouldn't* be required, but adding it doesn't help either
    # password: the-secret-password   # This works, but we don't want to hard code secrets!
    ca_cert_path: "/etc/ssl/certs/ca-certificates.crt"
env:
  - name: GF_DATABASE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: grafana-db
        key: secret

Grafana should ideally read the GF_DATABASE_PASSWORD environment variable if it exists. The OP is trying to do the same by setting GF_FOO. In my case, we have a setup that automatically pulls secret-env variables from a vault and that setup doesn't work with grafana since the chart expects me to hardcode the secret.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

[gldraphael]

Hey @andrew-pickin-epi could you add [stable/grafana] to the title?

[NikolaeVarius]

experiencing the same issue

[scottrigby]

#22903 (comment) is correct. env is expected to be a map:

charts/stable/grafana/templates/_pod.tpl

Lines 53 to 57 in 8736171

	env:
	{{- range $key, $value := .Values.downloadDashboards.env }}
	- name: "{{ $key }}"
	value: "{{ $value }}"
	{{- end }}

The pod template creates the array from the values map. IMO this is actually a good pattern for charts, because it allows an environment variable to be deleted or overwritten by key as opposed to array index which is more error prone.

Can someone experiencing this issue please verify that this works?

[scottrigby]

This is correct. 30 second test steps:

$ kind create cluster
Creating cluster "kind" ...
$ helm install issue-22903 stable/grafana --set env.FOO=bar,env.BAZ=qux
$ kubectl describe deployments.apps issue-22903-grafana

Relevant output:

Pod Template:
  Containers:
   grafana:
    Environment:
      BAZ:                         qux
      FOO:                         bar

Cleanup:

$ kind delete cluster
Deleting cluster "kind" ...

[gldraphael]

@scottrigby I can confirm that setting env this way works. Thank you.
Was also able to read GF_DATABASE_PASSWORD from a kubernetes secret by setting:

envFromSecret: "secretName"

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

[scottrigby]

This chart is deprecated: #23662
If still applicable, please re-open issues at: https://github.com/grafana/helm-charts

Though I think this one has been answered 😄